CVE-2026-104380: CWE-1385 Missing Origin Validation in WebSockets

Punk versions 0.48 through before 0.55 have a missing Origin validation in WebSocket handling. Specifically, Extended CONNECT requests used for WebSocket handshakes on HTTP/2 and HTTP/3 are treated as GET requests and routed to all GET routes without an Origin check in the ps_serve_one function. The Origin check is only performed when a WebSocket route matches, which does not occur for these Extended CONNECT requests. Consequently, a cross-origin web page can open a WebSocket to any path and determine if that path returns a 2xx response or an error, potentially leaking information about accessible routes.

An attacker controlling a cross-origin web page can probe any path on the affected Punk server by initiating WebSocket connections and observing whether the connection is accepted or rejected. This can lead to information disclosure about accessible GET routes and API operations, potentially aiding further attacks or reconnaissance.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting cross-origin WebSocket connections or implementing additional Origin validation at the application level for Extended CONNECT requests on HTTP/2 and HTTP/3.